Thomas Gleixner 34b1a1ce14 futex: Handle faults correctly for PI futexes ... fixup_pi_state_owner() tries to ensure that the state of the rtmutex, pi_state and the user space value related to the PI futex are consistent before returning to user space. In case that the user space value update faults and the fault cannot be resolved by faulting the page in via fault_in_user_writeable() the function returns with -EFAULT and leaves the rtmutex and pi_state owner state inconsistent. A subsequent futex_unlock_pi() operates on the inconsistent pi_state and releases the rtmutex despite not owning it which can corrupt the RB tree of the rtmutex and cause a subsequent kernel stack use after free. It was suggested to loop forever in fixup_pi_state_owner() if the fault cannot be resolved, but that results in runaway tasks which is especially undesired when the problem happens due to a programming error and not due to malice. As the user space value cannot be fixed up, the proper solution is to make the rtmutex and the pi_state consistent so both have the same owner. This leaves the user space value out of sync. Any subsequent operation on the futex will fail because the 10th rule of PI futexes (pi_state owner and user space value are consistent) has been violated. As a consequence this removes the inept attempts of 'fixing' the situation in case that the current task owns the rtmutex when returning with an unresolvable fault by unlocking the rtmutex which left pi_state::owner and rtmutex::owner out of sync in a different and only slightly less dangerous way. Fixes: 1b7558e457 ("futexes: fix fault handling in futex_lock_pi") Reported-by: gzobqq@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org		2021-01-26 15:11:00 +01:00
..
bpf	bpf: Fix signed_{sub,add32}_overflows type handling	2021-01-20 17:19:40 +01:00
cgroup	Merge branch 'for-5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2020-12-28 11:16:38 -08:00
configs	staging: ION: remove some references to CONFIG_ION	2021-01-06 17:39:38 +01:00
debug	smp: Cleanup smp_call_function*()	2020-11-24 16:47:49 +01:00
dma	dma-mapping updates for 5.11:	2020-12-22 13:19:43 -08:00
entry	The new preemtible kmap_local() implementation:	2020-12-14 18:35:53 -08:00
events	Merge branch 'exec-update-lock-for-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-12-15 19:36:48 -08:00
gcov	gcov: fix kernel-doc markup issue	2020-12-15 22:46:18 -08:00
irq	genirq: Export irq_check_status_bit()	2021-01-13 15:48:05 +01:00
kcsan	kcsan: Fix encoding masks and regain address bit	2020-11-06 17:19:26 -08:00
livepatch	livepatch: Use the default ftrace_ops instead of REGS when ARGS is available	2020-11-13 12:15:28 -05:00
locking	rtmutex: Remove unused argument from rt_mutex_proxy_unlock()	2021-01-26 15:10:58 +01:00
power	Power management updates for 5.11-rc1	2020-12-15 16:30:31 -08:00
printk	Merge branch 'printk-rework' into for-linus	2021-01-25 14:29:35 +01:00
rcu	Merge branch 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu	2021-01-04 10:55:19 -08:00
sched	sched: Relax the set_cpus_allowed_ptr() semantics	2021-01-22 15:09:44 +01:00
time	ntp: Fix RTC synchronization on 32-bit platforms	2021-01-12 21:13:01 +01:00
trace	tracing/kprobes: Do the notrace functions check without kprobes on ftrace	2021-01-11 16:09:53 -05:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	…
Kconfig.preempt	…
Makefile	kcov: don't instrument with UBSAN	2020-12-15 22:46:19 -08:00
acct.c	kernel/acct.c: use #elif instead of #end and #elif	2020-12-15 22:46:15 -08:00
async.c	treewide: Remove uninitialized_var() usage	2020-07-16 12:35:15 -07:00
audit.c	audit: replace atomic_add_return()	2020-12-02 22:52:16 -05:00
audit.h	audit: change unnecessary globals into statics	2020-08-17 20:26:58 -04:00
audit_fsnotify.c	fsnotify: generalize handle_inode_event()	2020-12-03 14:58:35 +01:00
audit_tree.c	fsnotify: generalize handle_inode_event()	2020-12-03 14:58:35 +01:00
audit_watch.c	fsnotify: generalize handle_inode_event()	2020-12-03 14:58:35 +01:00
auditfilter.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
auditsc.c	audit/stable-5.11 PR 20201214	2020-12-16 10:54:03 -08:00
backtracetest.c	treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()	2020-07-30 11:15:58 -07:00
bounds.c	…
capability.c	LSM: Signal to SafeSetID when setting group IDs	2020-10-13 09:17:34 -07:00
compat.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
configs.c	…
context_tracking.c	…
cpu.c	Scheduler updates:	2020-12-14 18:29:11 -08:00
cpu_pm.c	notifier: Fix broken error handling pattern	2020-09-01 09:58:03 +02:00
crash_core.c	kdump: append uts_namespace.name offset to VMCOREINFO	2020-12-15 22:46:18 -08:00
crash_dump.c	…
cred.c	…
delayacct.c	…
dma.c	…
exec_domain.c	…
exit.c	kernel/io_uring: cancel io_uring before task works	2020-12-30 19:36:54 -07:00
extable.c	…
fail_function.c	fault-injection: handle EI_ETYPE_TRUE	2020-12-15 22:46:19 -08:00
fork.c	Kernel: fork.c: Fix coding style: Do not use {} around single-line statements	2021-01-11 12:55:01 +01:00
freezer.c	…
futex.c	futex: Handle faults correctly for PI futexes	2021-01-26 15:11:00 +01:00
gen_kheaders.sh	…
groups.c	LSM: Signal to SafeSetID when setting group IDs	2020-10-13 09:17:34 -07:00
hung_task.c	kernel/hung_task.c: make type annotations consistent	2020-11-02 12:14:19 -08:00
iomem.c	…
irq_work.c	irq_work: Optimize irq_work_single()	2020-11-24 16:47:49 +01:00
jump_label.c	jump_label: Fix usage in module __init	2020-12-18 16:53:12 +01:00
kallsyms.c	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
kcmp.c	Merge branch 'exec-update-lock-for-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-12-15 19:36:48 -08:00
kcov.c	kernel: make kcov_common_handle consider the current context	2020-11-02 18:00:20 -08:00
kexec.c	LSM: Introduce kernel_post_load_data() hook	2020-10-05 13:37:03 +02:00
kexec_core.c	crypto: sha - split sha.h into sha1.h and sha2.h	2020-11-20 14:45:33 +11:00
kexec_elf.c	…
kexec_file.c	crypto: sha - split sha.h into sha1.h and sha2.h	2020-11-20 14:45:33 +11:00
kexec_internal.h	…
kheaders.c	…
kmod.c	kmod: remove redundant "be an" in the comment	2020-08-12 10:58:01 -07:00
kprobes.c	Merge branch 'linus' into perf/kprobes	2020-11-07 13:18:49 +01:00
ksysfs.c	…
kthread.c	- Correct the marking of kthreads which are supposed to run on a specific,	2021-01-24 10:09:20 -08:00
latencytop.c	…
module-internal.h	…
module.c	Modules updates for v5.11	2020-12-17 13:01:31 -08:00
module_signature.c	…
module_signing.c	…
notifier.c	notifier: Fix broken error handling pattern	2020-09-01 09:58:03 +02:00
nsproxy.c	fixes-v5.11	2020-12-14 16:40:27 -08:00
padata.c	padata: fix possible padata_works_lock deadlock	2020-09-04 17:51:55 +10:00
panic.c	panic: don't dump stack twice on warn	2020-11-14 11:26:04 -08:00
params.c	Modules updates for v5.11	2020-12-17 13:01:31 -08:00
pid.c	Merge branch 'exec-update-lock-for-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-12-15 19:36:48 -08:00
pid_namespace.c	fixes-v5.11	2020-12-14 16:40:27 -08:00
profile.c	…
ptrace.c	Merge branch 'akpm' (patches from Andrew)	2020-12-15 12:53:37 -08:00
range.c	kernel.h: split out min()/max() et al. helpers	2020-10-16 11:11:19 -07:00
reboot.c	reboot: hide from sysfs not applicable settings	2020-12-15 22:46:19 -08:00
regset.c	regset: kill ->get()	2020-07-27 14:31:12 -04:00
relay.c	relay: allow the use of const callback structs	2020-12-15 22:46:18 -08:00
resource.c	kernel/resource.c: fix kernel-doc markups	2020-12-15 22:46:18 -08:00
resource_kunit.c	resource: provide meaningful MODULE_LICENSE() in test suite	2020-11-25 18:52:35 +01:00
rseq.c	…
scftorture.c	scftorture: Add full-test stutter capability	2020-11-06 17:13:56 -08:00
scs.c	scs: switch to vmapped shadow stacks	2020-12-01 10:30:28 +00:00
seccomp.c	seccomp updates for v5.11-rc1	2020-12-16 11:30:10 -08:00
signal.c	for-linus-2021-01-24	2021-01-24 09:35:28 -08:00
smp.c	Merge branch 'linus' into sched/core, to resolve semantic conflict	2020-11-27 11:10:50 +01:00
smpboot.c	kthread: Extract KTHREAD_IS_PER_CPU	2021-01-22 15:09:42 +01:00
smpboot.h	…
softirq.c	Misc fixes/updates:	2020-12-27 09:06:10 -08:00
stackleak.c	stackleak: let stack_erasing_sysctl take a kernel pointer buffer	2020-09-19 13:13:39 -07:00
stacktrace.c	stacktrace: Remove reliable argument from arch_stack_walk() callback	2020-09-18 14:24:16 +01:00
static_call.c	static_call: Fix return type of static_call_init	2020-10-02 21:18:25 +02:00
stop_machine.c	Merge branch 'linus' into sched/core, to resolve semantic conflict	2020-11-27 11:10:50 +01:00
sys.c	kernel: Implement selective syscall userspace redirection	2020-12-02 15:07:56 +01:00
sys_ni.c	epoll: wire up syscall epoll_pwait2	2020-12-19 11:18:38 -08:00
sysctl-test.c	…
sysctl.c	rcu: Panic after fixed number of stalls	2020-11-19 19:37:16 -08:00
task_work.c	task_work: remove legacy TWA_SIGNAL path	2020-12-12 09:17:38 -07:00
taskstats.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
test_kprobes.c	…
torture.c	rcutorture: Make stutter_wait() caller restore priority	2020-11-06 17:13:54 -08:00
tracepoint.c	tracepoints: Migrate to use SYSCALL_WORK flag	2020-11-16 21:53:15 +01:00
tsacct.c	…
ucount.c	…
uid16.c	…
uid16.h	…
umh.c	usermodehelper: reset umask to default before executing user process	2020-10-06 10:31:52 -07:00
up.c	…
user-return-notifier.c	…
user.c	user: Use generic ns_common::count	2020-08-19 14:14:12 +02:00
user_namespace.c	fixes-v5.11	2020-12-14 16:40:27 -08:00
usermode_driver.c	umd: Stop using split_argv	2020-07-07 11:58:59 -05:00
utsname.c	uts: Use generic ns_common::count	2020-08-19 14:13:20 +02:00
utsname_sysctl.c	…
watch_queue.c	watch_queue: Limit the number of watches a user can hold	2020-08-17 09:39:18 -07:00
watchdog.c	kernel/watchdog: fix watchdog_allowed_mask not used warning	2020-11-14 11:26:03 -08:00
watchdog_hld.c	…
workqueue.c	workqueue: Restrict affinity change to rescuer	2021-01-22 15:09:43 +01:00
workqueue_internal.h	…